jetify-com/devbox 0.18.5

on GitHub

What's Changed

✨ New Features

• Pin the devbox version a project needs with devbox_version — add "devbox_version": "^0.18.0" (or any npm-style constraint) to devbox.json and devbox warns when someone runs the project with a version outside that range. Use the object form, {"version": "0.18.5", "on_mismatch": "error"}, to fail instead of warn. DEVBOX_VERSION_POLICY=off|warn|error overrides the policy for CI or emergencies. Older devbox releases ignore the field, so enforcement starts with this release, by @mikeland73 (#2990)
• "on_mismatch": "auto" switches to the pinned version for you — with an exact version pinned, devbox re-runs the command through the launcher on the right release, downloading it if needed, and nested devbox commands inside the shell stay on it. Installs without the launcher (Nix, Homebrew) get an error with install instructions instead, by @mikeland73 (#2991)

🐛 Bug Fixes

• devbox.lock no longer flips between devbox versions — shell, run and install stopped rewriting each package's plugin_version to match the running binary, so teams on different devbox versions don't fight over the lockfile. add, rm and update still refresh it, by @mikeland73 (#2989)
• Flaky network downloads are retried — Nix commands that fail on a truncated tarball, a connection reset, a curl timeout or an HTTP 5xx are now retried up to three times with a short backoff, by @mikeland73 (#2995)
• Shell and run fixes — devbox run inside a devbox shell now honors -e, --env-file and --pure; shells work when TMPDIR contains a space; the .devbox/bin/devbox symlink follows devbox upgrades; devbox run script --flag -- x and devbox global run pass flags through correctly; a relative --env-file next to -c path/devbox.json resolves from the config's directory; and --debug works after subcommand flags, by @mikeland73 (#3013) and (#3008)
• CLI fixes — devbox log (called from every shellrc) no longer exits 1; update --all-projects respects --no-install and only syncs the packages you named; generate debug and generate devcontainer accept -c/--environment; and --quiet and the version check now apply to generate, services and global subcommands, by @mikeland73 (#3008)
• Config fixes — a null script no longer panics every command in the project; devbox add --outputs takes effect on the same install and doesn't write duplicates; setting patch to auto removes the legacy patch_glibc key; and the Poetry detector stops pinning Poetry to your project's own version, by @mikeland73 (#3009)
• Package and lockfile fixes — devbox list --outdated no longer panics on unlocked packages; devbox update stops re-fetching GitHub flakes already pinned to a rev and no longer writes a 1970 last_modified; flake inputs with different dir or host get distinct names; @-scoped names like nodePackages.@vue/cli@5.0 parse correctly; a corrupt print-dev-env cache is recomputed instead of breaking the shell; and network errors from search are no longer reported as "package not found", by @mikeland73 (#3010)
• glibc patching fixes — patched binaries no longer get an empty RPATH entry, which made the loader search the current directory for libraries; statically linked binaries no longer abort the build; CUDA libraries are refreshed after a driver upgrade and added only once; and runx: packages no longer break the patch flake, by @mikeland73 (#3012)
• Services, plugins and templates — devbox services start a b no longer hangs on a leaked lock; services start/stop/restart exit non-zero when a service fails; an unknown plugin: include is a clear error instead of a panic; git plugins pinned to an older rev on a ref check out correctly; and devbox create copies dotfiles like .envrc and .gitignore, handles paths with spaces, and doesn't force --repo templates onto the devbox version branch, by @mikeland73 (#3011)
• Devcontainer generation detects versioned packages like python@3.12 and go@latest, and handles sibling directories with a shared prefix, by @mikeland73 (#3013).

🧹 Maintenance

• Built with Go 1.27; updated Go module dependencies, GitHub Actions, lint tooling, the tested Nix versions, and the VS Code extension's dependencies, by @mikeland73 (#3006), (#3007), (#3004) and (#3005)
• Updated the JavaScript, Python, JVM, Ruby, PHP, .NET and other examples, and pointed the remote flakes example at an in-repo flake, by @mikeland73 (#3014), (#3015) and (#2994)
• Silenced CI warnings and added a spec of performance improvement opportunities, by @mikeland73 (#2988) and (#3017)

Full Changelog: 0.18.4...0.18.5